Privacy Policy

How we handle your data, protect your privacy, and use AI securely.

Last Updated: March 6, 2026

LangGrade ("we", "us", "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy describes how we collect, use, process, and disclose your personal information across our Platform, in compliance with applicable privacy laws including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), the EU General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA).

1. Information We Collect

We may collect the following types of information:

  • Account Details: Your name, email address, and login information via third-party authentication providers (Google) or email/password sign-up. We do not store passwords in plaintext; they are managed by Firebase Authentication.
  • Profile Information: Target exam (CELPIP, TCF Canada, TEF Canada), target score, native language, preferred AI voice, and custom learning goals.
  • Usage Data: Test scores, AI feedback history, practice session duration, vocabulary saved, spaced repetition progress, and interaction logs.
  • Audio Recordings: Voice clips submitted for AI speaking evaluation. Audio data is processed temporarily by our AI service provider and is not stored permanently after analysis is complete.
  • Payment Information: Subscription status, plan type, and billing history. All credit card information is processed exclusively by Stripe, Inc. and never touches our servers.
  • Device & Analytics Data: IP address (anonymized), browser type, device information, and page interactions collected via Google Analytics with IP anonymization enabled.

2. Legal Basis for Processing (GDPR)

We process your personal data under the following legal bases:

  • Contractual Necessity: To provide the LangGrade service you signed up for (account management, AI evaluation, subscription billing).
  • Consent: For optional features such as analytics cookies and marketing communications. You may withdraw consent at any time.
  • Legitimate Interest: For service improvement, fraud prevention, and security monitoring, balanced against your privacy rights.
  • Legal Obligation: To comply with tax, accounting, and regulatory requirements.

3. How We Use Your Data

  • Provide, operate, and maintain the LangGrade Platform.
  • Evaluate your speaking and writing inputs using third-party AI models (Google Gemini).
  • Personalize the user experience with tailored exams and difficulty settings.
  • Process subscription payments and prevent fraud via Stripe.
  • Improve our product by analyzing anonymized aggregate usage data.
  • Send important security alerts, service updates, and account notifications.
  • Enforce our Terms of Service and prevent abuse.

4. Automated Decision-Making and AI Evaluation

LangGrade uses automated AI systems (Google Gemini) to evaluate your speaking and writing responses and assign practice scores. These evaluations are for practice purposes only and do not constitute official exam results. You have the right to request a human review of any AI-generated evaluation by contacting us. No decisions with legal or significant effects (such as employment or academic admission) are made solely based on automated processing.

5. Audio Processing

Submitting audio for speaking practice requires temporary cloud processing. Your audio data is transmitted securely (TLS encryption in transit) to Google Gemini for transcription and evaluation. Audio data is processed in real-time and is not retained after the evaluation is complete. We instruct our AI service providers not to use LangGrade user audio to train their models.

6. Third-Party Disclosures

We do not sell your personal data. We only share it with trusted third-party service providers essential for platform functionality:

  • Authentication: Firebase Authentication (Google).
  • Database & Hosting: Firebase Cloud Firestore, Google Cloud Platform.
  • AI Services: Google Gemini API for natural language evaluation and voice synthesis.
  • Payment Processor: Stripe, Inc. for secure payment handling.
  • Analytics: Google Analytics (with IP anonymization).

Each third-party is contractually bound to protect your data and use it only for the specified service.

7. Cross-Border Data Transfers

Your data may be transferred to and processed in countries outside your jurisdiction, including the United States and other countries where Google Cloud, Firebase, and Stripe operate. When data is transferred outside of Canada or the EU, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) and compliance with PIPEDA cross-border transfer requirements.

8. Data Retention

We retain your account information and practice history for as long as your account is active. Payment records are retained for the period required by applicable tax laws (typically 7 years). If you request account deletion, all associated personal data (profile, test records, vocabulary, session history) will be permanently removed from our databases within 30 days. Anonymized aggregate data may be retained indefinitely for analytics.

9. Your Data Rights

Depending on your location and applicable laws (PIPEDA, GDPR, CCPA), you have the following rights:

  • Access: Request a copy of the personal data we hold about you.
  • Correction: Request correction of inaccurate or incomplete data.
  • Deletion: Request deletion of your data ("Right to Be Forgotten").
  • Portability: Receive your data in a structured, machine-readable format.
  • Restriction: Request restriction of processing of your personal data.
  • Objection: Object to processing based on legitimate interest.
  • Withdraw Consent: Where processing is based on consent, withdraw it at any time.
  • Do Not Sell (CCPA): We do not sell personal information. California residents may exercise their rights under CCPA by contacting us.

To exercise any of these rights, contact us at privacy@langgrade.com. We will respond within 30 days (or sooner as required by applicable law).

10. Children's Privacy

LangGrade is not directed at children under the age of 16. We do not knowingly collect personal information from children. If we discover that a child under 16 has provided us with personal data, we will delete it promptly. If you are a parent or guardian and believe your child has provided information to us, please contact privacy@langgrade.com.

11. Cookies and Local Storage

Our platform uses:

  • Essential Cookies/Storage: Session tokens, authentication state, and user preferences (e.g., dark mode, preferred AI model). These are required for the Platform to function.
  • Analytics Cookies: Google Analytics cookies to understand aggregate usage patterns. These are loaded only when analytics is configured and can be controlled through your browser settings.

We do not use advertising or tracking cookies.

12. Security

We implement industry-standard security measures to protect your data, including TLS encryption in transit, server-side firewall rules (Firestore Security Rules), role-based access control, rate limiting, and Content Security Policy headers. All secrets and API keys are stored in encrypted environment variables, never in source code. Despite these measures, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

13. Updates to Privacy Policy

We may periodically update this policy. When significant changes occur, we will notify you by email or through a dashboard notification at least 15 days prior to the change taking effect. The "Last Updated" date at the top reflects the most recent revision.

14. Contact Us

If you have privacy-related concerns, data requests, or complaints, please reach out to:

  • Email: privacy@langgrade.com
  • General Support: support@langgrade.com

If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada (OPC), your local EU Data Protection Authority, or the California Attorney General, as applicable.