Privacy Policy

1. Who we are

EnglishHub Technologies Inc.(“EnglishHub”, “we”, “us”) is the data controller for personal information collected through the EnglishHub website, apps, and related services (collectively, the “Service”). This Privacy Policy explains what we collect, how we use it, with whom we share it, and the choices you have.

If you have questions about this policy or how we handle your data, contact our privacy team at [email protected].

2. What we collect

a) Data you give us

• Account data: name, email address, password (hashed), profile preferences, and exam selections.
• Billing data: subscription plan and billing history. Card details are handled directly by Stripe, Inc. — we do not store raw card numbers or CVVs.
• User content: written responses, audio recordings, and other practice submissions you make while using the Service.
• Communications: messages you send us via email, support forms, or in-app feedback.

b) Automatically collected data

• Usage data: pages visited, features used, practice attempts, session duration, and click interactions.
• Device and technical data: browser type and version, operating system, device type, screen resolution, and language settings.
• IP address and approximate location: derived from IP at the country or city level.
• Cookies and similar technologies: described further in section 9.

c) From third parties

• Payment confirmation from Stripe (transaction ID, last 4 digits, billing country).
• Auth metadata from social login providers (Google, Apple) if you choose that sign-in method.
• Referral information from affiliate or partner links, if applicable.

3. How we use your data

• Provide, operate, and secure the Service, including processing your practice submissions through our AI scoring systems.
• Process payments and manage subscriptions via Stripe.
• Send transactional communications (account verification, password resets, billing receipts, subscription updates).
• Personalize your experience, such as tracking your progress and recommending practice areas.
• Improve the Service by analyzing aggregated, anonymized usage patterns and product performance.
• Detect and prevent fraud, abuse, and security incidents.
• Comply with legal obligations, respond to authority requests, and enforce our Terms of Service.

4. Legal bases (GDPR)

If you are in the EU, EEA, or UK, we process your data on the following legal bases:

5. Who we share with

We share your data only to the extent necessary to deliver the Service. Categories of recipients include:

• Infrastructure and hosting (e.g., Vercel, AWS) for serving the application and storing data.
• Speech-to-text and AI processing for evaluating speaking responses.
• Payment processing (Stripe, Inc.) for subscription billing.
• Email delivery for transactional and service communications.
• Analytics and error monitoring to track platform health and usage (privacy-preserving configurations where possible).
• Professional advisers (lawyers, accountants, auditors) under confidentiality obligations.
• Authorities when required by applicable law, court order, or to protect the rights and safety of users.
• Corporate transaction successors in the event of a merger, acquisition, or sale of assets, with notice to users.

6. International transfers

EnglishHub operates from Canada and uses service providers in Canada, the United States, and the European Union. When we transfer personal data outside your country, we rely on appropriate safeguards:

• EU Standard Contractual Clauses (SCCs) for transfers to non-adequate countries from the EU/EEA.
• UK International Data Transfer Addendum for transfers from the United Kingdom.
• Adequacy decisions (Canada is recognized as adequate by the EU Commission).
• EU-U.S. Data Privacy Framework where applicable.

To request a copy of the relevant transfer mechanism, email [email protected].

7. How long we keep data

8. Your rights

Depending on where you live, you may have the following rights regarding your personal data:

• Access: obtain a copy of the personal data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure / deletion: ask us to delete your personal data (subject to legal retention obligations).
• Restriction: ask us to restrict processing of your data in certain circumstances.
• Objection: object to processing based on legitimate interests or for direct marketing.
• Portability: receive your data in a structured, machine-readable format.
• Withdraw consent: where processing is based on consent, withdraw it at any time.
• Automated decision review: request human review of any automated decision that significantly affects you.
• Complaint: lodge a complaint with your local data protection authority.

California residents (CCPA/CPRA)

California residents have the right to know what personal information we collect and how it is used, the right to delete personal information, the right to correct inaccurate personal information, the right to opt out of the sale or sharing of personal information (we do not sell or share for cross-context behavioral advertising), and the right not to be discriminated against for exercising these rights.

To exercise any of these rights, email [email protected]. We will respond within 30 days. We may ask you to verify your identity before acting on a request.

9. Cookies and tracking

We use cookies and similar technologies for the following purposes:

In regions where consent is required (EU/EEA, UK), you will be presented with a cookie banner on first visit. You can update your cookie preferences at any time from your account settings.

10. Children

The Service is not directed to children under 13, or under 16 in jurisdictions where 16 is the minimum age of digital consent. We do not knowingly collect personal data from such children. If you believe a child has provided us with personal data, please contact [email protected] and we will delete it promptly.

11. Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• TLS encryption for all data in transit.
• Encryption at rest for sensitive fields (passwords are hashed and salted and never stored in plaintext).
• Role-based access controls limiting who can access personal data internally.
• Audit logging and monitoring for anomalous access patterns.
• Regular security updates and vulnerability assessments.

No transmission or storage system is 100% secure. If we experience a data breach that poses a real risk of harm, we will notify affected users and applicable authorities as required by law.

12. Automated decisions

We do not make legally significant automated decisions about you — such as credit, employment, or immigration decisions. Practice scoring by our AI is study feedback only and has no legal or similarly significant effect on your status. You are always free to disregard AI feedback and retake practice as you wish.

13. Third-party links

The Service may contain links to websites operated by third parties (for example, official exam provider sites). We are not responsible for the privacy practices of those third parties. We encourage you to read their privacy policies before providing them with any personal data.

14. Changes

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. For material changes, we will notify you by email or in-app notification before the change takes effect. Continued use of the Service after a change constitutes acceptance of the updated policy.

15. Contact