Privacy Policy

1. Who is responsible

Mohamed Bassam, trading as Liguastic in the United Arab Emirates, decides how and why your personal data is handled and is the data controller for it. Contact: hello@liguastic.com.

2. What we collect

Account details

• Your name and email address.
• Your phone number, given when you create the account. We hold it to reach you about your account. We do not send marketing messages to it, and it is never passed to anyone outside the processors listed below.
• Your password, stored only as a cryptographic hash — we cannot read it, and neither can anyone who steals the database.
• One-time verification codes, stored hashed and short-lived.

Learning data

• Your placement result: overall CEFR level and a per-skill breakdown.
• Your goals — target exam, exam date, target band, daily study minutes, the skills you want to focus on, and your native language.
• Your answers to lesson questions and mock tests, and whether they were right.
• Essays you write, and the feedback given on them.
• Speaking recordings and transcripts. When you record a speaking answer we keep the audio so you can play back what was scored, along with the transcript. Only your 10 most recent recordings are kept — older attempts keep their transcript, scores and feedback, and the audio is deleted. Our support and teaching-quality staff can play these back too, for the reasons and under the logging described in who else handles your data. Delete your account and every recording goes with it.
• Your conversations with the AI tutor.
• Your mistake notebook, vocabulary and review schedule.

Your native language is collected for one specific reason: it lets the tutor explain things in terms of the differences between that language and English, which is materially more effective than generic explanation.

Children’s data

If you add a child to your account, we hold a small amount of data about them too — a nickname, a date of birth, an age group, an avatar and what they have practised. It is set out in full, with the reason for each part, in Children below.

Payment data

We never see your card. Payment is handled entirely by our merchant of record (see below). We receive only the fact that a subscription exists, its plan, its status and its renewal date.

Technical data

• A session cookie that keeps you logged in. It is strictly necessary — the site cannot work without it.
• Standard server logs from our hosting providers, which include IP addresses and are used for security and debugging.
• Where your first visit came from: the page you landed on and when, the name of the site that linked to it, and any campaign tags in the link. It is kept in your browser and saved with your account when you sign up, so we can tell which pages bring people to Liguastic.

We use Google Analytics to count visits and see which pages are read. It sets cookies and it is a third party, so it is named in the processor list below. We do not use advertising cookies or tracking pixels, we do not run ads, and we do not sell or share your data with advertisers.

3. Why we use it

• To provide the service — placing you at a level, building your plan, generating and marking work, and keeping your progress. This is necessary to perform our contract with you.
• To manage your account and subscription — verification, receipts, renewal notices. Contract and legal obligation.
• To keep the service secure and working — abuse prevention, debugging, capacity. Our legitimate interest in running a safe service.
• To improve teaching quality — reviewing aggregate patterns in what learners get wrong. Legitimate interest, and done on aggregate data wherever possible.
• To teach a child at the right level — a child’s date of birth decides which age group their lessons are written for, and keeps deciding it as they grow. Consent, given by the parent who holds the account.

We do not use your data for advertising, and we do not sell or rent it.

4. AI processing

Generating and marking your work means processing it with our AI. When you answer a question, submit an essay, finish a speaking task or message the tutor, the relevant content is processed together with the context needed to make the reply useful — such as your level, recent mistakes and current plan step.

It is processed strictly on our instructions, and it is never used to train any model — not by us, and not by the specialist providers listed in our terms who operate parts of this pipeline under contract to us.

Recorded speaking answers are additionally processed by our speech assessment, which scores pronunciation and fluency from the audio itself — something a transcript cannot show. That step receives the recording, the task you were answering, and an anonymous reference for you that is never your email address. A typed speaking answer never enters it.

We may change how this pipeline is operated, and if we do we will update this page before the change takes effect.

If you would rather a particular piece of writing were not processed this way, do not submit it — everything sent to the tutor or the graders goes through this path.

5. Who else handles your data

We use a small number of providers to run Liguastic. Each one only gets what it needs to do its job.

• Our AI — Generates lessons, feedback and tutor replies. Receives: Your learning content — answers, essays, speaking transcripts, chat messages. Never used to train any model. Operated in part by specialist providers under contract to us, named in our terms.
• Our speech assessment — Scores pronunciation and fluency in spoken answers. Receives: Your speaking recordings, the task you were answering, and an anonymous learner reference. Only recorded answers enter it — a typed answer never does, and the reference is never your email address.
• Creem.io — Merchant of record — takes payment and handles sales tax. Receives: Your name, email and payment details. Card details go straight to Creem. They never reach our servers.
• Resend — Sends verification codes and account email. Receives: Your email address.
• Vercel — Hosts the website. Receives: Technical request logs, including IP address.
• Google Analytics — Counts visits and shows which pages are read. Receives: Your IP address, the pages you view, and an analytics cookie. Marketing pages only — it is not loaded inside the learning app, so nothing you write, say or score ever reaches it.
• Railway — Hosts the application server and database. Receives: Everything stored in your account.

Beyond these, we disclose data only where the law requires it, or to establish or defend a legal claim.

Our own staff

A small number of Liguastic staff can see the learning data described above when they need to: to answer a support question, to investigate a mark that looks wrong, and to check that the marking and the lessons are actually doing their job. That is our legitimate interest in running a service that teaches correctly, and it is the only reason we look.

This includes listening to a speaking recording — a pronunciation or fluency mark cannot be checked from a transcript, because a transcript does not carry the sound the mark was given for. Playback is limited to the recordings still within the retention window described above, so staff can never reach further back than you can yourself.

Every one of those actions is written to an internal log, against the name of the staff member who took it, before it happens — including each time a recording is played. The log is append-only: we can tell you who looked at what, and nobody can quietly remove their own entry.

6. Where your data goes

Our providers operate internationally, so your data is processed outside the United Arab Emirates — principally in the United States and the European Union. Where a transfer leaves a region with equivalent protection, it relies on the provider’s standard contractual clauses.

7. How long we keep it

• While your account is open — your learning history is kept, because it is the thing that makes the tutoring adaptive. Deleting it would reset your progress.
• After you delete your account — your personal data and learning history are deleted within 30 days.
• Billing records — kept as long as tax and accounting law requires, typically up to seven years. These are held by our merchant of record.
• Speaking recordings — only your 10 most recent are kept. Each new recording deletes the oldest beyond that, automatically.
• Server logs — kept for a short period by our hosting providers, then rotated out.
• Our staff-access log — kept as a security record. It holds who did what and to which record, including each time a recording was played; it does not hold the content they saw.

You can also reset your learning data on its own, from Settings, without closing your account.

8. Your rights

You can ask us to:

• Give you a copy of the data we hold about you.
• Correct anything that is wrong — most of it you can edit yourself in Settings.
• Delete your account and everything in it.
• Restrict or object to a particular use.
• Export your data in a portable format.

Email hello@liguastic.com and we will respond within 30 days. There is no charge. If you are unhappy with how we have handled a request, you may complain to your local data protection authority.

9. Children

Anyone holding their own Liguastic account must be 16 or over. A child under 16 never holds an account, a login, an email address or a password. They learn on a profile a parent creates inside the parent’s own account, and they can only be reached by an adult who is already signed in on their own device.

We do collect data about a child on such a profile, because we cannot teach one without it. This is what it is and what each part is for.

What we hold about a child

• A nickname or first name, chosen by you — so the child recognises their own profile. A full name is never required.
• A date of birth. It decides which age group the lessons are written for, and moves the child up as they grow so that a twelve-year-old is not still being taught as a six-year-old. It is used for nothing else: it is never shown to the child, never used to identify them, and never shared.
• An avatar and an age group — a picture the child can recognise before they can read, and the level their work is pitched at.
• An optional four-digit PIN, stored hashed, so a child can re-enter their own world without an adult unlocking it each time.
• What they did in each episode — the story or activity, the words it taught, which beats they got right first go, and how long the sitting lasted.
• The words they have met and when each should come back for review, and the result of their starting check.

What we do not hold

• No account, login, email address, phone number or password for the child.
• No photograph, and no real name unless you type one.
• No recording of the child’s voice.When a child says a word, the audio is sent to our pronunciation scorer to be marked and is not stored by us afterwards. The scorer receives a one-way reference, never the child’s name or profile.
• Nothing used for advertising or profiling. We do not sell or rent any of it.

Why we are allowed to hold it

A child profile can only be created on an account with an active paid subscription. That card payment is the verifiable parental consent event, and we record which version of this notice was in force when it was given. There is no free route to creating a child profile — that is a deliberate choice about consent, not a sales tactic.

What you can do

The parent who holds the account can see everything above at any time, rename a child, remove their profile, or have it erased outright. Removing the last child also withdraws the consent record. Delete the account and every child profile on it goes with it. Email hello@liguastic.com and we will act within 30 days at no charge.

If you believe a child has been given a Liguastic account of their own, rather than a profile under a parent, email us and we will delete it.

10. Security

• All traffic is encrypted in transit over HTTPS.
• Passwords are hashed, never stored in a readable form.
• Sessions use signed, HTTP-only cookies that JavaScript cannot read.
• Database access is restricted to the application, and every query is scoped to the account making it.

No system is perfectly secure. If a breach ever affects your data, we will tell you and the relevant authority without undue delay.

11. Changes

If we change this policy in a way that matters, we will email you before it takes effect. The date at the top always shows the current version.

12. Contact

hello@liguastic.com. See also our Terms of Service.