Privacy Policy

IELTS International (“we”, “us”, or “our”) operates www.ielts.international and the IELTS AI Coach mobile app for iOS and Android (together, the “Service”). This Privacy Policy explains how we collect, use, disclose, retain, and safeguard personal data when you use the Service.

We are committed to protecting your privacy and ensuring you have control over your personal information. This policy is designed to be transparent about our data practices and your rights.

By using the Service, you consent to the practices described in this policy. If you do not agree, please do not use the Service.

Data Controller: IELTS International, registered in Brazil. For data protection inquiries, contact us at hello@ielts.international.

Account data: When you create an account, we collect your name, email address, and password (stored as a secure hash). Authentication is managed by Supabase.

Subscription & payment data: Website payments are processed by Stripe. Mobile purchases are processed by Apple App Store or Google Play, with RevenueCat used to validate purchases and manage entitlements. We receive identifiers, product, transaction, subscription, renewal, and entitlement status, but do not receive or store your full card number, CVV, or bank account details.

Level test & practice data: Your level test answers, band scores, essay submissions, handwriting images you choose to upload, speaking transcripts, and practice session data are stored in our database to provide personalised feedback and track your progress.

Audio & voice data:When you use speaking practice features, your voice is recorded via your device’s microphone. Audio is transmitted to our servers for AI-powered transcription and evaluation. Recordings are processed transiently and are not retained by IELTS International; text transcripts and evaluation results may be stored with your practice history.

Email subscription: If you sign up for our newsletter, we collect your email address and optionally your target IELTS band.

Usage data: We automatically collect information such as your IP address, browser type, operating system, pages visited, time spent on pages, and referring URLs.

Device data: We may collect information about your device, including device type, operating system and app version, screen resolution, language preference, and diagnostics. In the mobile app, consent-based analytics may also use an analytics or device identifier.

Notifications: If you enable mobile reminders, we store your notification preferences and a push token used to deliver them.

We use the data we collect to:

• Provide, maintain, and improve the Service
• Process payments and manage your subscription
• Deliver personalised preparation feedback and track your progress
• Send you IELTS preparation tips and updates (if subscribed)
• Respond to your support requests
• Deliver reminders and notifications you enable
• Analyse usage patterns to improve content and features
• Detect and prevent fraud, abuse, or security issues
• Comply with legal obligations

We share data with the following third-party service providers, each with their own privacy policies:

• Supabase— Authentication and database hosting. Stores your account data and practice history.
• Stripe— Payment processing. Receives your payment information directly.
• Apple and Google— Mobile sign-in, app distribution, and in-app payment processing.
• RevenueCat— Mobile purchase validation, subscription status, and entitlement management.
• OpenAI, Anthropic, Google (Gemini), DeepSeek, and Deepgram— AI, OCR, and speech providers. Essay text, handwriting images, audio or transcripts, and practice responses may be sent to these services for transcription, evaluation, and feedback. We do not intentionally send your name or email with practice content.
• Google Cloud— Text-to-speech and translation services for speaking practice and content localisation.
• PostHog— Product analytics and, for consenting users, website session replay used to diagnose usability problems. Mobile analytics starts only after opt-in and does not use session replay.
• Google Analytics / Google Tag Manager— Website analytics enabled only after consent.
• Google Ads / DoubleClick and Reddit Ads— Advertising, conversion measurement, and remarketing enabled only after advertising consent.
• Datadog RUM— Performance diagnostics, interaction telemetry, and sampled session replay enabled only after analytics consent.
• Resend— Transactional email delivery. Receives your email address to deliver account notifications, password resets, and preparation tips.
• Cloudflare Turnstile— Bot protection. Collects device and interaction signals to verify you are human. No CAPTCHAs are shown.
• Vercel— Website hosting. Processes requests and may log IP addresses.
• Expo— Mobile app updates and push-notification delivery.
• Sentry— Mobile error and reliability diagnostics.

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

This section mainly concerns the website. The mobile app does not use browser cookies for product analytics and does not use personal data for cross-app tracking.

We use the following types of cookies:

• Essential cookies: Required for the Service to function (authentication session, locale preference).
• Analytics cookies: PostHog and Google Analytics cookies to understand how users interact with the Service, only after analytics consent.
• Advertising cookies: Google Ads / DoubleClick and Reddit Ads may measure conversions and support remarketing, only after advertising consent.
• Payment cookies: Stripe may set cookies during the checkout process for fraud prevention.
• Bot protection: Cloudflare Turnstile may store cookies or local storage tokens to distinguish legitimate users from automated traffic.

Non-essential analytics and advertising technologies are disabled by default. Use the Cookie settings control on any public page to accept, reject, or later withdraw consent. In the mobile app, analytics starts only after you opt in and can be changed from Profile. Disabling essential storage may affect Service functionality.

Active accounts: We retain your data for as long as your account is active and you are using the Service.

Deleted accounts: Account-linked content is removed from active systems when deletion is completed. Limited backup, security, fraud, transaction, or legal records may remain only for the period reasonably necessary or required by law. De-identified analytics that can no longer identify your account may be retained.

Cancelled subscriptions: Account data is retained for 12 months after cancellation in case you wish to reactivate. After 12 months of inactivity, data may be deleted.

Email subscriptions: Your email is retained until you unsubscribe. You can unsubscribe at any time using the link in any email we send.

Payment records: Transaction records are retained for the period required by applicable tax, accounting, fraud-prevention, and consumer laws.

Mobile-specific data: Speaking audio is not retained by IELTS International after processing. Push tokens are kept while notifications are enabled or until they expire.

We implement industry-standard security measures to protect your data:

• All data transmitted over HTTPS (TLS encryption)
• Passwords stored using secure hashing (bcrypt via Supabase)
• Payment credentials handled by Stripe, Apple, or Google rather than our servers
• Database access restricted by Row Level Security (RLS) policies
• Security headers (CSP, HSTS, X-Frame-Options) on all pages

No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately.

Depending on your jurisdiction, you may have the right to:

• Access— Request a copy of the personal data we hold about you
• Correction— Request correction of inaccurate data
• Deletion— Request deletion of your personal data
• Portability— Request your data in a machine-readable format
• Objection— Object to processing of your data for certain purposes
• Withdraw consent— Withdraw consent for data processing at any time

You can delete an account directly in the mobile app under Profile, on the website Profile page, or by following the public account deletion instructions. To exercise another right, email us at hello@ielts.international. We will respond within 30 days.

The Service is not intended for children under 16. We do not knowingly collect data from children under 16. If we learn that we have collected data from a child under 16, we will delete it promptly. If you believe a child has provided us with personal data, please contact us.

Your data may be processed in countries outside your own, including the United States (Supabase, Stripe, Vercel, OpenAI, Anthropic, PostHog), the European Union, and other jurisdictions where our service providers operate. We ensure that appropriate safeguards are in place for international data transfers, including standard contractual clauses where required.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under the General Data Protection Regulation (GDPR). Our lawful bases for processing are:

• Contract performance— to provide the Service you signed up for (account, subscriptions, practice features)
• Legitimate interest— to improve the Service, prevent fraud, and ensure security
• Consent— for marketing emails and non-essential analytics cookies (you may withdraw consent at any time)
• Legal obligation— to comply with applicable tax and financial record-keeping laws

You have the right to lodge a complaint with your local data protection authority if you believe your data has been processed unlawfully.

If you are located in Brazil, you have rights under the Lei Geral de Proteção de Dados (LGPD), including the right to access, correct, delete, and port your data. The data controller is IELTS International, contactable at hello@ielts.international.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice on the Service at least 14 days before they take effect. The “Effective Date” at the top indicates when the policy was last revised.

If you have questions about this Privacy Policy or want to exercise your data rights, contact us at:

Email: hello@ielts.international

We typically respond within 24 hours.