Privacy Policy

1. Who we are and who is accountable

EnglishHub.io (“we”, “us”), 251 Jarvis St, Toronto, ON M5B 0C3, Canada, is responsible for the personal information collected through the EnglishHub.io website, apps, and related services (the “Service”). Under Canadian privacy law (PIPEDA) and, for residents of Quebec, the Act respecting the protection of personal information in the private sector (as amended by Law 25), we are accountable for that information, including when one of our service providers handles it for us. For people in the EU, EEA or UK, we are the “controller”.

2. What we collect

a) Information you give us

• Account: name, email address, password (stored only as an Argon2 hash), and optionally a profile photo, phone number, country and time zone.
• Study preferences: the exam you are preparing for, your target score, test date and (for OET) your profession.
• Your practice work: answers, written responses, speaking recordings and their transcripts, scores and AI feedback (including which mock exam or practice set each result was, which we use to show your progress and to unlock the AI Generator), the messages you send to the AI Tutor, and a count of the AI Generator picks you have used each month (kept for about 70 days).
• Billing: your plan and billing history. Card details go directly to Stripe; we never see or store full card numbers or CVVs.
• Consent records: when you accept the Terms, opt in to marketing email, or click Subscribe at checkout (agreeing to the auto-renewal terms and asking for access to start immediately), we record what you agreed to, the exact wording shown, where, and when.
• Messages to us: emails and contact-form messages.

b) Information collected automatically

• Sign-in sessions: IP address, browser/device description and session times, for security.
• Country at sign-up: the country your connection came from when you created your account, as reported by our network provider (Cloudflare) — a two-letter country code only, not your IP address. We use it to understand where our learners are and which markets to serve.
• Server logs: IP address, account id, pages and API calls requested, errors, and an audit trail of sign-ins, billing events and staff actions.
• Usage statistics through Google Analytics 4, only if you allow it (section 10).
• Cookies and browser storage: listed one by one in section 10.

c) Information from others

• Google, if you sign in with Google: your email, name, profile picture and Google account id.
• Stripe: payment status, the last four digits of your card and your billing country.
• Referrals: the referral code of a friend whose link you followed.

3. Why we use it

We collect only what we need for these purposes, and we tell you about any new purpose before using your information for it:

• Create and run your account, and provide practice, mock exams, progress tracking and the leaderboard.
• Score your writing and speaking with AI and transcribe your recordings, and answer your AI Tutor questions.
• Process payments, renewals, cancellations and refunds.
• Send service emails: verification, password resets, receipts, renewal reminders, score notifications and important changes.
• Send study tips and offers by email — only if you opted in (section 4).
• Keep the Service secure: detect fraud and abuse, investigate errors, and keep audit records.
• Understand how the site is used (Google Analytics, only with your consent) and improve the Service using aggregated statistics.
• Meet legal obligations and enforce our Terms.

4. Consent and your choices

• Creating an account means you consent to the uses in section 3 that are needed to provide the Service. You can withdraw by deleting your account (Settings → Account); we will then no longer be able to provide the Service to you.
• Marketing email is optional and off unless you tick the box at sign-up or turn it on in Settings. The box names the sender (EnglishHub.io) and says what you will receive. We record the date, the place and the exact wording of your consent. You can withdraw at any time in Settings, or from the unsubscribe link in any marketing email; we record when you withdrew and stop sending. Service emails about your account and purchases are not marketing and continue while you have an account.
• Speaking recordings: a recorded speaking answer is sent to our speech and AI providers for transcription and scoring. Your browser asks for your permission before the microphone can be used, and recording happens only inside speaking tasks.
• Analytics cookies load only if you accept them, and you can change your choice any time from “Cookie settings” in the footer of every page.

5. Legal bases (EU, EEA and UK)

If the GDPR or UK GDPR applies to you, we rely on these legal bases:

6. Who receives your information

We do not sell personal information and do not share it for cross-context behavioural advertising. We share it only with the service providers below, who process it for us under contract, and otherwise only with professional advisers bound by confidentiality, with authorities where the law requires it, or with a buyer of our business (we would tell you first).

AI providers. Which AI provider scores your work and answers the AI Tutor is a setting we control. At the date of this policy it is Google Cloud Vertex AI. The other providers marked “configured alternative” are set up so we can switch to them without changing our software; they are listed so this policy stays true if we do. Speaking recordings always go to Microsoft Azure for transcription. Pronunciation and intonation are assessed from the recording itself only while Vertex AI or the Gemini API is the active provider; with any other provider only the transcript is scored. Each provider handles the data under its own API terms, which may allow it to keep requests for a limited time (for example for abuse monitoring). Google Cloud's and Microsoft Azure's terms say they do not use customer data to train their models; the alternatives' data-use settings vary, which is one reason they are not active.

Our database, cache, job queue, logs and monitoring run on our own servers at Hetzner; they are not shared with a further provider.

7. Where your information is processed

EnglishHub.io is based in Canada, but your information is stored and processed outside Canada: our servers are in the European Union (Hetzner, Germany/Finland), and several providers in section 6 are in the United States, and in one case (DeepSeek, an inactive alternative) in China. While it is in another country, your information is subject to that country's laws and may be accessed by its courts, law-enforcement and national-security authorities.

We protect information sent to providers with contractual commitments on confidentiality and security, and we choose providers whose data-processing terms we can rely on. For information leaving the EU, EEA or UK we rely on adequacy decisions (including for Canada and, where the provider is certified, the EU–U.S. Data Privacy Framework) or on the European Commission's Standard Contractual Clauses and the UK Addendum included in our providers' data-processing terms.

You can ask for more information about these transfers, or a copy of the safeguards, at [email protected].

8. How long we keep it

We keep personal information only as long as we need it for the purposes above, then delete it.

9. Your rights and how to use them

• Access: ask what personal information we hold about you, how we use it and who it has been shared with, and get a copy. Email us; you can also see most of it yourself in Settings, your dashboard and your results.
• Correction: update your profile in Settings, or ask us to correct anything you can't change yourself.
• Withdrawing consent: turn marketing email off in Settings, change cookie choices from “Cookie settings” in the footer, or delete your account in Settings → Account.
• Deletion: delete your account yourself in Settings, or ask us (some records must be kept as described in section 8).
• Portability (EU/EEA/UK and Quebec): receive the information you gave us in a structured, commonly used format.
• EU/EEA/UK: you can also ask us to restrict processing or object to processing based on legitimate interests.
• California residents have the right to know, delete and correct personal information and not to be discriminated against for using these rights. We do not sell or share personal information for cross-context behavioural advertising.

To make a request, email our Privacy Officer at [email protected] or use the contact form from the address on your account (or tell us how to verify you). We answer within 30 days, free of charge, and explain any refusal and how to challenge it.

Complaints

Please contact us first so we can try to fix the problem. You can also complain to a regulator:

• Canada: the Office of the Privacy Commissioner of Canada (priv.gc.ca).
• Quebec: the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).
• United Kingdom: the Information Commissioner's Office (ico.org.uk).
• EU/EEA: the data protection authority of the country where you live or work.

10. Cookies and browser storage

We use the cookies and browser storage listed below. Strictly necessary and functional items make the features you use work and are always on. Google Analytics cookies are set only if you accept them in the cookie banner. We do not use advertising or cross-site tracking cookies. You can change your choice at any time from “Cookie settings” in the footer of every page (signed in or not); the same list is on our Cookie Policy page.

Google Analytics 4 (Google Ireland Ltd. / Google LLC) tells us which pages are visited, where visitors come from and how features are used. Advertising features, ad personalisation and Google signals are off. Google's processing is described at policies.google.com/privacy.

11. Children

You must be 16 or older to create an account, and you confirm this when you sign up. The Service is not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact [email protected] and we will delete it.

12. Security safeguards

We protect personal information with safeguards suited to its sensitivity, including:

• Encryption (TLS) for data travelling between your browser and our servers.
• Passwords stored only as salted Argon2 hashes, never in readable form.
• Encryption of stored secrets such as two-factor keys and provider credentials, and of the database backups we send by email.
• Access to the admin panel limited to staff accounts with an admin or moderator role, and an audit log of sign-ins, billing events and staff actions.
• Rate limits on sign-in and other sensitive actions.

No system is perfectly secure, and we cannot guarantee that your information will never be accessed without permission.

13. If something goes wrong

We keep a record of every breach of security safeguards involving personal information, for at least 24 months. If a breach creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as soon as feasible, as PIPEDA requires (and the Commission d'accès à l'information for a confidentiality incident affecting Quebec residents that presents a risk of serious injury). Where the GDPR or UK GDPR applies, we notify the competent authority within 72 hours where required and tell affected people without undue delay if the risk to them is high.

14. AI feedback and automated processing

Scores and feedback on your writing and speaking are produced automatically by AI. They are practice estimates for study purposes only — not official scores and not a prediction of your real result — and they have no legal or similarly significant effect on you. The AI Tutor is an AI assistant, not a person, and can make mistakes. If you think a score or feedback is wrong, you can ask us at [email protected] to look at it, and you are always free to disregard it.

Our blog cover illustrations are AI-generated and labelled as such.

15. Third-party links

The Service links to websites we do not control (for example, official exam providers). Their own privacy policies apply there.

16. Changes

We may update this policy. We will change the “Last updated” date at the top, and for material changes we will tell you by email or in the app before they take effect. If a change means we want to use your information for a new purpose, we will ask for your consent where the law requires it.

17. Contact