Privacy Policy

1. Who We Are

EP Education Ltd(trading as EnglishPerfect) (“we”, “us”, “our”) is the data controller for personal data collected through englishperfect.org. We are registered in England and Wales.

We are subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where we process data of individuals in the European Economic Area (“EEA”), the EU GDPR also applies.

Questions about this policy or your data: privacy@englishperfect.org

2. Data We Collect

Account data

• Full name, email address, date of birth (students), and password (hashed — we never store plaintext passwords)
• Profile photo (optional)
• Country and timezone
• Role: student, teacher, or admin

Student data

• IELTS target band score, current estimated band, target test date, and weakest module — set by you in Settings
• Lesson booking history and completed lesson records
• IELTS Writing submissions (essay text)
• AI-generated and teacher-finalised feedback on Writing submissions
• Practice test attempts and scores
• Band score progress data over time
• Reviews you leave for teachers
• For students under 18: parent/guardian name, relationship, and consent timestamp (collected at checkout)

Teacher data

• Teaching credentials and qualifications (uploaded files)
• Government-issued identity document (uploaded for vetting; stored securely)
• Bio, headline, languages spoken, years of experience
• Availability windows and lesson pricing
• Stripe Connect account ID and onboarding status (we do not store bank account details — Stripe handles these)
• Session delivery metrics (join/leave times, lesson duration)
• Rolling review scores and access status
• Teacher notes written during lessons

Payment data

All payment processing is handled by Stripe. We store only a reference to the Stripe payment intent ID and the booking it relates to. We do not store card numbers, bank account details, or any other sensitive financial data. Stripe’s privacy policy governs their handling of your payment data.

Usage and technical data

• IP address (used for parental consent records for minor students)
• Browser type and device information (standard web server logs)
• Session activity within the classroom (join/leave times)
• Notification read status

Communications

If you contact us by email, we retain the content of that communication and your email address in order to respond and, where relevant, to resolve disputes.

3. How We Use Your Data

We use your personal data to:

• Create and manage your account
• Match students with teachers and facilitate bookings
• Process payments and issue refunds via Stripe
• Deliver the live classroom experience via Daily.co
• Generate AI-assisted IELTS Writing feedback via Anthropic Claude
• Send transactional emails: booking confirmations, lesson reminders (24 h and 1 h before), post-lesson review requests, and slot availability notifications (Resend)
• Display progress charts and band score history to students
• Operate the automated teacher quality and access control system
• Detect and prevent fraud, abuse, and sanctioned-country payments
• Comply with legal obligations
• Communicate material changes to these policies

We do not use your data for advertising, sell it to third parties, or use it to train AI models. IELTS essay submissions are processed by Anthropic Claude solely to produce writing feedback for the submitting student and are not retained by Anthropic beyond the duration of that API call (subject to Anthropic’s own data retention policies).

4. Legal Bases for Processing (UK GDPR)

We process your data on the following legal bases:

• Contract performance — processing necessary to deliver the services you have booked or applied for (e.g. account management, booking fulfilment, payouts to teachers).
• Legitimate interests — operating and improving the platform, fraud prevention, quality control of teachers, and ensuring platform safety, where these interests are not overridden by your rights.
• Legal obligation — retaining financial records, responding to lawful requests from authorities.
• Consent — where you have explicitly opted in, for example to receive slot availability notifications for a specific teacher. You may withdraw consent at any time.
• Vital interests — in the limited circumstances where processing is necessary to protect someone's life.

For students under 16, we rely on parental/guardian consent. Students between 16 and 18 may consent in their own right for most processing; payment requires additional parental consent per our checkout process.

5. Data Sharing and Third Parties

We share your data only with the processors and parties necessary to operate the platform:

All third-party processors are bound by Data Processing Agreements and are required to process data only on our instructions and in accordance with applicable data protection law.

We may disclose your data if required to do so by law, court order, or to protect the rights, property, or safety of EnglishPerfect, our users, or others. We will notify you of such disclosure where legally permitted to do so.

6. International Data Transfers

Several of our processors are based in the United States. We transfer data to the US under appropriate safeguards, including Standard Contractual Clauses (“SCCs”) approved under UK GDPR, or where processors participate in recognised adequacy frameworks.

You may request details of the specific transfer mechanisms in place by contacting privacy@englishperfect.org.

7. Data Retention

We retain your data for as long as your account is active, plus the following periods:

• Account and profile data — deleted within 90 days of account closure on request
• Booking and payment records — 7 years from the date of transaction (legal requirement for financial records)
• IELTS Writing submissions and feedback — retained while your account is active; deleted within 30 days of account closure on request
• Practice test attempts — retained while your account is active
• Teacher credentials and identity documents — deleted within 30 days of account closure or rejection, unless legal obligations require longer retention
• Parental consent records for minor students — retained for the duration of the student's account and 2 years after closure
• Server and access logs — 90 days

8. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — ask us to correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten") — request deletion of your data, subject to our legal retention obligations
• Right to restriction — ask us to limit how we use your data in certain circumstances
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests
• Rights related to automated decision-making — we do not make solely automated decisions with legal or similarly significant effects on individuals

To exercise any of these rights, email privacy@englishperfect.org. We will respond within 30 days. We may need to verify your identity before fulfilling a request.

If you are dissatisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

9. Children and Young People

EnglishPerfect is available to students aged 16 and over. Students under 18 require parental or guardian consent to make bookings, which is collected and recorded at the time of each payment.

We do not knowingly collect personal data from children under 16. If we become aware that a person under 16 has created an account without parental consent, we will delete the account promptly. If you believe a child under 16 is using our platform, please contact privacy@englishperfect.org.

10. Cookies

EnglishPerfect uses only the following cookies:

• Authentication session cookies — strictly necessary, set by Supabase to keep you logged in. These cannot be disabled without breaking the platform.
• No advertising cookies, tracking pixels, or third-party analytics cookies are set.

We do not use Google Analytics, Facebook Pixel, or any other third-party behavioural tracking tools.

11. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• All data in transit is encrypted via TLS
• Database access is controlled by Row Level Security (RLS) — each user can access only their own data
• Passwords are hashed and never stored in plaintext
• Payment data is handled entirely by Stripe — we do not store card details
• Teacher credential documents are stored in private, access-controlled storage
• API keys and secrets are stored as environment variables, never in source code

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO within 72 hours of becoming aware, as required by UK GDPR.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify you by email or by a prominent notice on the platform at least 14 days before the changes take effect. The “last updated” date at the top of this page reflects the most recent revision.

13. Contact and Complaints

For any questions, data requests, or concerns about this policy:

EP Education Ltd (trading as EnglishPerfect)
Registered in England and Wales
Email: privacy@englishperfect.org

You also have the right to complain to the Information Commissioner’s Office:
ico.org.uk/make-a-complaint · 0303 123 1113