Privacy Policy

Last updated: October 6, 2026

This Privacy Policy explains how English AIdol collects, uses, discloses, stores, and protects personal information in connection with our English learning platform, websites, mobile experiences, AI-assisted study tools, content publishing workflows, and related services.

1. Controller and Scope

English AIdol ("English AIdol", "we", "us", or "our") operates an online educational service that provides English learning, test preparation, speaking practice, writing feedback, vocabulary tools, study materials, and related AI-assisted features. This Privacy Policy applies to visitors, registered users, subscribers, students, educators, applicants, partners, and other individuals who access or interact with our services.

This Policy applies to information collected through englishaidol.com, related subdomains, application interfaces, customer support channels, payment flows, authentication services, analytics tools, and integrations that we operate or control. It does not apply to websites, applications, or services operated by third parties that maintain their own privacy policies.

2. Categories of Information We Collect

2.1 Account and Identity Information

When you create an account, subscribe, sign in, or contact us, we may collect identifiers such as name, email address, account ID, login method, profile preferences, country or language settings, and customer support records.

2.2 Educational and User-Generated Content

We may collect and process learning content that you submit, including writing responses, speaking recordings, transcripts, answers, scores, saved vocabulary, practice history, uploaded files, quiz results, study plans, notes, and feedback requests. This information is used to provide educational analysis, generate study feedback, preserve progress, and improve the learning experience.

2.3 Audio, Speech, and AI Interaction Data

For speaking, pronunciation, dictation, conversation, and AI tutor features, we may collect audio recordings, microphone input, speech transcripts, pronunciation analysis, timing data, model prompts, generated feedback, and related technical metadata. Audio and transcript processing is used to deliver speaking assessment, pronunciation feedback, fluency analysis, and other requested educational functionality.

2.4 Payment and Subscription Information

When you purchase a subscription or paid feature, payment details may be processed by third-party payment providers such as Apple or Stripe. We may receive limited transaction information such as plan type, purchase status, billing email, subscription identifiers, invoices, tax status, refund-request events, and payment confirmation. We do not intentionally store full payment card numbers on our own servers.

2.4.1 Apple App Store Refund Reviews

If Apple tells us that an App Store customer requested a refund and that customer has provided specific consent through our consent process, we may send Apple whether the purchase was delivered, whether a trial or sample was available, and our refund recommendation based on aggregate activity counts and estimated practice time. We retain the consent basis in our records and stop this sharing if the customer withdraws that consent.

We do not send Apple the customer's answers, recordings, transcripts, scores, or message content for this review. Apple makes the final refund decision.

2.5 Technical, Usage, and Device Information

We may automatically collect log data, device identifiers, browser type, operating system, IP address, approximate location inferred from technical data, referral URL, pages viewed, session duration, clicks, feature usage, crash reports, diagnostic data, and other information about how the service is accessed and used.

2.6 Cookies and Similar Technologies

We and our service providers may use cookies, local storage, pixels, SDKs, and similar technologies to authenticate users, preserve preferences, measure usage, prevent abuse, analyze performance, attribute marketing, and improve product reliability. Browser settings may allow you to restrict certain cookies, although some service features may not function properly without them.

Our social-automation control plane is restricted to authorized administrators acting for the professional social account or YouTube channel owner. It may be used for English AIdol accounts or client accounts that an administrator is expressly authorized to manage. The separate Creator Publishing feature lets participating English AIdol customers connect their own accounts and choose to share their original videos. A connection is optional and does not give other users access to that account.

Connection data: we store the connected professional account and linked Page identifiers, display name or username, profile image URL, granted permissions, connection and webhook health, token expiry information, and limited account or media metadata needed for the selected automation.
Credentials: provider access and refresh tokens are encrypted in restricted server-side secret storage and are not displayed in the control plane.
Comment and consented-reply automation: a signed Meta webhook may contain a comment or message ID, media ID, commenter or sender identifier or username, comment or incoming message text, and a timestamp. We process comment text to evaluate the administrator's rule. When a person voluntarily replies to a comment-linked private reply, we process whether the incoming message is non-empty and then check follow state inside Meta's allowed messaging window. We do not retain the raw webhook payload, raw incoming comment text, or raw incoming message text in the social-automation tables.
Limited automation evidence: to prevent duplicates, enforce limits, show a redacted session state, and reconcile provider delivery, we may retain limited provider comment, message, or action IDs; a one-way actor fingerprint rather than the raw Instagram actor ID; administrator-authored public reply, private reply, reminder, and delivery templates; follow-check outcome; rule, job, and session statuses; and relevant timestamps. A new follow alone does not trigger a webhook or outbound message.
Publishing: when an administrator uploads or selects a creator-owned master asset, we first store and verify it in restricted service storage. For provider publishing that requires a server-readable URL, we then place a content-addressed copy at an unlisted, provider-readable English AIdol URL. The URL is not intentionally indexed, but anyone who obtains the exact URL may be able to retrieve the asset. We process that asset and its reviewed platform captions, audience choices, and rights or disclosure settings only to send the selected release to connected provider accounts.
Google and YouTube Authorized Data: for a connected YouTube channel, we use youtube.readonly only to retrieve the authorized channel ID, name, handle, and profile image so the administrator can confirm the exact destination. We use youtube.upload only to upload an administrator-reviewed video with its title, description, privacy, and made-for-kids choice. We do not browse subscriptions or the existing private video library, or read comments or analytics through this publishing feature.
Google Limited Use: English AIdol's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data or use it for advertising.
Use and disclosure: we use this data only to operate the administrator-selected connection, publishing, reply, security, and delivery-reconciliation features. The data is processed by Meta, other selected social providers, and our infrastructure providers as needed to perform those actions. We do not sell connected-account data.

2.8 Creator Publishing

When you connect TikTok, Instagram or YouTube, we store the account identifiers, display name, profile image, granted permissions, connection status and token expiry needed to identify your destination and deliver your chosen post. Access and refresh tokens are encrypted in Supabase Vault and are never included in the browser response.

Your uploaded video stays in private storage. We give the selected provider a short-lived signed URL to retrieve it for publishing. Anyone who obtains that URL can access the file until the URL expires; keep it private. We also retain your chosen caption, title, visibility, audience and disclosure settings, plus delivery status and provider post identifiers so you can check the result. Creator Publishing does not read or automate your messages, comments, subscriptions or analytics, and does not add a watermark to your video.

For YouTube, youtube.readonly identifies your authorized channel and verifies the status of uploads made through this service; youtube.upload sends a video only after you confirm its title, visibility and audience. The Google Limited Use commitments above apply to Creator Publishing too. This data is not sold, used for advertising or used to train AI models.

Use Manage accounts in the publisher to disconnect. This stops pending uploads, removes local credentials and connected-account identifiers, and revokes Google or TikTok authorization where supported. Instagram access can also be removed in your Meta account settings. A post already accepted by a provider may finish processing; disconnecting does not delete that provider's copy. You can revoke Google access directly in Google Account permissions. Deleting your English AIdol account also removes its connected-account records and credentials. Unreferenced creator video files are removed by the scheduled cleanup once they are at least two days old. To request deletion of remaining content or support records, use the contact details below.

2.9 Google Calendar and Coaching

For booked coaching sessions, our connected teacher calendar is used to create session events and, when selected, Google Meet links. Booking details sent to Google can include your name, email, session time, time zone and the coaching information you provide. If you separately choose to connect your own Google Calendar, we can add your booked session there too. We use calendar access for these booking features, not advertising or AI model training. You can revoke the connection in Google Account permissions and request deletion of the stored connection through support.

3. Sources of Information

We collect information directly from you, automatically through your use of the service, from authentication and payment providers, from analytics and infrastructure vendors, from customer support interactions, and from publicly available or user-authorized sources where relevant to a feature you request.

4. Purposes of Processing

We use personal information for the following business and educational purposes:

To provide, operate, maintain, and secure English AIdol services.
To create accounts, authenticate users, manage sessions, and preserve preferences.
To generate AI-assisted writing, speaking, pronunciation, vocabulary, grammar, and test-preparation feedback.
To save progress, learning history, scores, reports, study plans, and user settings.
To process payments, manage subscriptions, issue receipts, and prevent billing fraud.
To respond to support requests, troubleshoot issues, and communicate service updates.
To monitor service reliability, diagnose errors, prevent abuse, and protect against unauthorized access.
To perform analytics, product measurement, A/B testing, and performance optimization.
To comply with legal obligations, enforce agreements, and protect the rights, property, and safety of English AIdol, users, and the public.
To develop new educational content, features, and quality improvements using aggregated, de-identified, or otherwise privacy-protective methods where appropriate.

5. Legal Bases for Processing

Where applicable privacy laws require a legal basis, we process personal information based on one or more of the following grounds: performance of a contract, legitimate interests in operating and improving our services, compliance with legal obligations, consent, protection of vital interests, or other grounds permitted by applicable law.

6. AI Processing and Automated Features

English AIdol uses automated and AI-assisted systems to provide educational outputs such as suggested corrections, predicted scores, pronunciation feedback, study recommendations, and content explanations. These outputs are provided for educational support and should not be treated as official test results, professional certification, immigration advice, legal advice, medical advice, or guaranteed academic outcomes.

We may send learner-submitted text, audio, transcripts and learning records to AI service providers when necessary to deliver a requested educational feature. Our configured AI services include Google Gemini, DeepSeek, AssemblyAI, Lemonfox, Fish Audio and OpenRouter, a gateway to third-party model providers. The provider used depends on the feature and availability.

Google Data and AI Separation

Information received from Google APIs is not used, transferred or sold to develop, train or improve foundational or generalized AI or machine-learning models. This restriction includes raw Google user data and aggregated, anonymized or derived forms of that data, and takes precedence over the general service-improvement descriptions in this policy.

Data obtained through our connected Google Calendar and YouTube features is kept out of AI requests, model gateways, training datasets and model-evaluation datasets. Calendar event details and Google Meet links are used for booking and session access; YouTube channel information, publishing choices and upload status are used for the selected publishing operation. OAuth credentials remain in the authenticated booking or publishing systems. These features do not supply Google API data to the AI services listed above.

Our educational AI features process content submitted for those features independently of the Calendar and YouTube integrations. Connecting a Google account does not authorize AI processing of its Calendar or YouTube data. We do not rely on an AI provider's paid-plan label, retention setting or training opt-out as a substitute for this separation.

7. Disclosure of Information

We do not sell personal information. We may disclose information in the following circumstances:

Service providers: hosting, storage, authentication, analytics, AI processing, email, payments, monitoring, security, and customer support vendors.
Legal and safety reasons: when required by law, subpoena, court order, governmental request, or when necessary to protect rights, safety, security, or property.
Business transfers: in connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction.
With your direction or consent: where you ask us to share information, connect a third-party service, export content, or publish material.
Aggregated or de-identified data: information that does not reasonably identify you may be used or disclosed for analytics, research, product improvement, or reporting.

8. International Data Transfers

English AIdol is used by learners in multiple countries. Information may be processed, stored, or transferred in jurisdictions other than the country where you reside. Where required, we use appropriate safeguards for international transfers, which may include contractual protections, technical controls, and vendor due diligence.

9. Data Retention

We retain personal information for as long as reasonably necessary to provide the service, maintain accounts, support learning history, comply with legal and accounting obligations, resolve disputes, prevent abuse, enforce agreements, and maintain security. Retention periods vary depending on the type of information, user settings, legal requirements, and operational needs.

When information is no longer needed, we may delete, de-identify, aggregate, or archive it in accordance with applicable law and our operational requirements.

Disconnecting a professional social account revokes provider authorization where the provider supports programmatic revocation, removes encrypted OAuth credentials, and blocks dependent web automation rules. For Google/YouTube, Authorized Data held by English AIdol is deleted or de-identified within seven days; an administrator can also revoke access at any time in Google Account permissions. Disconnecting does not delete a provider account or provider-held posts, videos, comments, or messages. An authorized account owner can request deletion or de-identification of eligible remaining Meta data using our Facebook and Instagram data deletion instructions. Limited security, backup, dispute, or legal records may be retained where permitted or required.

10. Security Measures

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information from unauthorized access, loss, misuse, alteration, or disclosure. These measures may include access controls, encrypted transmission, authentication controls, monitoring, logging, vendor review, and separation of production systems. No system is completely secure, and we cannot guarantee absolute security.

Data protection mechanisms for sensitive data and Google user data

Encrypted transport: Our production website and Google API requests use HTTPS/TLS to protect data in transit, including authorization exchanges and Calendar, YouTube, and account data.
Restricted credentials: Social-publishing access and refresh tokens are encrypted in Supabase Vault and retrieved only by authorized server-side operations. Calendar credentials are held in server-restricted database records. Provider tokens are not returned to the browser or displayed in account-management screens.
Access controls and account isolation: Authenticated server checks and database access policies restrict protected records to the authorized user or operational role. Calendar actions verify the saved teacher/student relationship and lesson; social-publishing actions verify the connected account and its owner before accessing credentials or sending a post.
Limited Google data use: We use Google data only for the features the account owner authorizes. Google Calendar and YouTube data, including sensitive data, is excluded from advertising and from AI requests, training and model-evaluation datasets. The Google Data and AI Separation and Google Limited Use disclosures in this policy apply.
YouTube review workspace: The local YouTube analytics and comment-reply workspace demonstrated for verification keeps its access token in server memory, does not persist a refresh token, and limits access to the selected channel. It validates channel, video and parent-comment ownership and requires explicit confirmation before publishing a reply. Its local browser connection is bound to the loopback interface; calls to Google use HTTPS. Disconnecting or ending the local server clears its authorization, and sessions expire after one hour. This workspace is separate from the production publishing feature.
Retention and revocation: Disconnecting stops dependent actions and removes stored social-publishing credentials. Google/YouTube Authorized Data is deleted or de-identified within seven days as described above. You can also revoke access in Google Account permissions or request deletion through support. Calendar connection deletion can be requested through support. We retain limited security or legal records only as described in the retention section.

11. User Choices and Privacy Rights

Depending on your jurisdiction, you may have rights to request access, correction, deletion, portability, restriction, objection, withdrawal of consent, or information about certain disclosures. You may also have the right to lodge a complaint with a data protection authority.

To exercise privacy rights, contact us using the information below. We may need to verify your identity before responding. Some requests may be limited by legal, security, fraud-prevention, accounting, or operational obligations.

12. Marketing Communications

If we send marketing emails, you may unsubscribe using the link provided in the email or by contacting us. We may still send non-marketing communications, such as account, payment, security, product, and support messages.

13. Children's Privacy

English AIdol is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we learn that personal information from a child under 13 has been collected without appropriate authorization, we will take reasonable steps to delete it.

14. Third-Party Links and Integrations

Our service may include links to third-party websites, platforms, payment processors, social networks, app stores, analytics providers, AI providers, or content services. Their privacy practices are governed by their own policies. We are not responsible for the privacy practices of third parties that we do not control.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal obligations, or business practices. The updated version will be posted on this page with a revised "Last updated" date. Continued use of the service after an update means the updated Policy applies to your use of the service.

16. Contact Information

English AIdol
Website: https://www.englishaidol.com
Email: [email protected]