Legal
Privacy Policy
What data POLYPRO collects, why we collect it, who we share it with, and the rights you have.
Updated May 22, 2026 · 9 sections
In short
- We never sell your dataEvery sub-processor is listed by name in this document.
- You stay in controlExport, correct or delete your account from Settings.
- AI history expiresConversations are kept 90 days, not forever.
A plain-language summary. The full text below is the version that applies.
Data we collect
- Account data: name, email, password (hashed), country, phone (optional), CEFR level, preferred language.
- Learning data: lesson progress, exercise attempts, quiz scores, AI conversation history, placement-test answers.
- Payment data: handled by Stripe; we store only the payment intent ID and a snapshot of the transaction.
- Technical data: IP address, browser/user-agent, page paths visited (for audit logging).
Why we collect it
- Deliver the learning experience (track progress, unlock content, grade exercises).
- Provide AI tutoring (conversation history is needed for the model to remember context).
- Process payments (Stripe legal requirement).
- Detect abuse and protect the platform (audit logs).
- Send transactional emails: account verification, password reset, payment receipts.
Legal basis (GDPR)
- Performance of contract — for account, learning, and payment data.
- Legitimate interest — for audit logs and abuse prevention.
- Consent — for marketing emails (opt-in only; you can opt out anytime).
Data sharing
- We do not sell your data.
- Sub-processors we use: Stripe (payments, collected on behalf of Master Learn Ltd), Resend (transactional email), Anthropic Claude & Google Gemini & ElevenLabs (AI providers — anonymized prompts where possible).
- We may disclose data if compelled by law or to protect platform safety.
Data retention
- Account data is retained while your account is active and for 12 months after deletion (for legal/tax reasons).
- Payment receipts are retained for 10 years (tax compliance).
- AI conversation history is retained for 90 days unless required for ongoing learning context.
- Audit logs are retained for 24 months.
Your rights
- Access — request a copy of your data (Settings → Export data).
- Rectification — edit your profile anytime.
- Erasure — delete your account (Settings → Delete account). Some data is retained as noted above.
- Portability — receive your data in a machine-readable format.
- Objection — withdraw consent for marketing or AI processing.
Security
- Passwords are hashed with Argon2id.
- JWT tokens are signed with HS256 and rotated.
- Data in transit is encrypted with TLS 1.3.
- Database backups are encrypted at rest.
Contact
- POLYPRO, its website polypro-academy.com and its mobile apps are operated by Master Learn Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom, which is the data controller.
- For privacy questions, write to privacy@polypro-academy.com.
- EU users can lodge a complaint with their local Data Protection Authority.
Related documents