Olly is preparing your space...

Olly English

Loading page content...

Legal Document

Privacy Policy

This policy explains what personal data Olly English collects, why we collect it, how we protect it, and the rights you have over it.

Last Updated

July 2026

At a Glance

Never Sold

We never sell your personal data or share it with advertisers.

Voice Stays Transient

Voice recordings are analysed in transit and are not stored after your session.

You Are in Control

Access, correct, export, or delete your data at any time under UK/EU GDPR.

Limited Retention

AI conversation history is purged after 12 months; deleted accounts after 30 days.

1. Who We Are

Olly English (“we”, “our”, “us”) is an AI-powered English learning platform available at ollyenglish.com. We act as the data controller for personal data collected through this platform.

For privacy enquiries, contact us at: our contact page or by email at info@ollyenglish.com.

2. What Data We Collect

2.1 Account Data

When you register, we collect:

Email address and display name
Authentication provider details (Google, email/password)
Account creation timestamp and last active date
Subscription plan and payment status

2.2 Usage Data

As you use the platform, we automatically collect:

Exercises completed, scores, and progress data
AI conversation history from roleplay and coaching sessions
Feature usage patterns and session durations
IP address, browser type, and device information
Pages visited and referral sources via analytics cookies

2.3 Voice & Audio Data

If you use the Pronunciation Coach or AI Roleplay voice features, your microphone input is transmitted to our speech-processing providers for real-time analysis: Groq (Whisper speech-to-text transcription for roleplay conversations) and Replicate (WhisperX phoneme-level alignment for pronunciation scoring). Correct-pronunciation playback audio is generated with Google Cloud Text-to-Speech. Voice recordings are processed in transit and are not stored permanently on our servers beyond the duration of the session.

2.4 Payment Data

Subscription payments are processed by third-party payment providers. We do not store full card numbers on our servers. We receive only a tokenised reference and your subscription status from the payment provider.

3. Why We Process Your Data (Lawful Basis)

Under the UK GDPR and EU GDPR, we process personal data only where we have a lawful basis to do so:

Purpose	Lawful Basis
Providing platform features and your account	Contract (Art. 6(1)(b))
Processing payments and preventing fraud	Contract & Legitimate Interests (Art. 6(1)(b)(f))
Improving AI models and platform performance	Legitimate Interests (Art. 6(1)(f))
Analytics cookies and performance tracking	Consent (Art. 6(1)(a))
Sending service-critical emails (password reset, billing)	Contract (Art. 6(1)(b))
Sending marketing emails or newsletters	Consent (Art. 6(1)(a)) — you can unsubscribe at any time
Complying with legal obligations	Legal Obligation (Art. 6(1)(c))

4. Third-Party Services & Data Sharing

We use the following third-party processors. Each has its own privacy policy and data processing agreement with us where required by law:

Google Firebase & Firestore — authentication, database, cloud storage, and analytics (Google Privacy Policy)
Google Gemini AI — generating AI responses in roleplay, writing feedback, and pronunciation coaching sessions
Google Cloud Text-to-Speech — generating correct-pronunciation playback audio
Groq — Whisper speech-to-text transcription of your voice input in AI roleplay conversations
Replicate — WhisperX acoustic analysis of your voice input for phoneme-level pronunciation scoring
Cloudflare Turnstile — bot detection on sign-in forms and AI features (no personal data stored by Cloudflare beyond what is needed for the challenge)
Resend — sending transactional emails such as password resets and account notifications
Upstash — rate-limiting infrastructure that briefly processes pseudonymous request identifiers to protect the platform from abuse
Payment Processors (including Stripe for live-tutoring bookings) — for subscription and lesson billing

We do not sell your personal data to third parties. We do not share your data with advertisers.

5. Data Retention

Account data — retained while your account is active, plus 30 days after deletion to allow for recovery requests.
AI conversation history — retained in your account for up to 12 months to power personalisation, then automatically purged.
Voice recordings — not retained after session processing (see §2.3 above).
Usage analytics — aggregated data may be retained indefinitely; event-level data is retained for 24 months.
Payment records — retained for 7 years to comply with financial reporting obligations.

6. International Data Transfers

Our infrastructure (Firebase / Google Cloud) is primarily based in the United States and European Union. Where personal data is transferred outside the UK or EEA, such transfers rely on the UK International Data Transfer Agreement (IDTA) or Standard Contractual Clauses (SCCs) approved by the European Commission, or adequacy decisions where applicable.

7. Your Rights

Under UK GDPR and EU GDPR, you have the following rights. To exercise any of them, contact us at our contact page. We will respond within 30 days.

Right of access — request a copy of the personal data we hold about you.
Right to rectification — ask us to correct inaccurate data.
Right to erasure (“right to be forgotten”) — request deletion of your personal data, subject to legal retention requirements.
Right to restrict processing — ask us to pause processing while a dispute is resolved.
Right to data portability — receive your data in a structured, machine-readable format.
Right to object — object to processing based on legitimate interests, including profiling.
Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting prior processing.
Right to lodge a complaint— you have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk or, if you are in the EU, to your local supervisory authority.

8. Cookies & Tracking

We use cookies and similar tracking technologies for essential functions, analytics, and personalisation. You can manage your cookie preferences at any time via the “Manage Cookies” link in the footer. For full details, see our Cookie Policy.

9. Children’s Privacy

Our platform is intended for users aged 13 and over. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it promptly. Users aged 13–17 should use the platform with parental consent.

10. Security

We implement industry-standard security measures including encrypted data transmission (TLS), HMAC-signed session tokens, Firebase App Check, rate limiting, and access controls. Despite these measures, no internet transmission is completely secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by applicable law.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or a prominent notice on the platform at least 14 days before taking effect. The “Last Updated” date at the top of this page reflects the most recent revision.

12. Contact Us

For any privacy-related questions, requests, or concerns, please contact us via our contact page or email info@ollyenglish.com. We aim to respond within 30 days.